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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 

WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 
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DETAILED ACTION 

1. This Office Action is response to communication filed on 1/22/2007. 

2. Applicant's amendments to claims 1 - 18 are acknowledged. Consequently, rejection to 
claims 1 - 8 under 35 U.S.C. 1 12, second paragraph is withdrawn. Claims 2 - 3, 1 1 - 12, 14 - 15 
have been cancelled. Claims 1, 4 - 10, 13, and 16 - 18 are currently pending. 

Information Disclosure Statement 

3. The information disclosure statement (IDS) submitted on 1 /22/2007 is in compliance 
with the provisions of 37 CFR 1.97, 1.98, and MPEP §600. Accordingly, the information 
disclosure statement has been placed in the application file and is being considered by the 
examiner. 

Claim Rejections - 35 USC § 102 

4. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

5. Claims 1,4-10, 13, and 16 - 18 are rejected under 35 U.S.C. 102(b) as being anticipated 
by Fujiwara et al (U.S. 2003/0014394 Al). 

♦ As per claims 1, 10 

Fujiwara discloses a machine-implemented method, a machine-readable medium (Fig. 7 of 
Fujiwara) for managing access to data, the method comprising the steps of: 
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- "Registering with a database server a policy function supplied by a user" See Fig. 12, in 
particular: 

• A database server corresponds to database server 722 (See Fig. 7, element 722, 
paragraph 0040). Fujiwara teaches "a single computer system can be used to host 
all three servers components in a small scale operation" (page 3, paragraph 0041). 
Therefore, the Examiner would interpret the reference as single computers sever. 

• A policy function corresponds to the access policy (Fig. 8) that is registered or 
stored in the database server computer and is provided by the user (administrator 
personnel or database management personnel) (See paragraph 0044) 

- "Said database server detecting that a database command requires access to columns in at 
least two tables" corresponds to the command send from a user using a third computer 
system (Fig. 1 1 wherein the command specified multiple columns, page 3, paragraph 
0042, page 6 paragraph 0068 of Fujiwara). Fujiwara discloses a SELECT statement that 
can select multiple tables (Fig. 1 1). Therefore, clearly this command requires access to 
columns in at least two tables as claimed in claims invention. 

- " And in response to the step of detecting, said database server invoking of said policy 
function to generate a condition expression returned by the policy function" See Fig. 12 
wherein the query is modified by the access policies (page 6, paragraph 0071 - 0074). 
The "condition expression returned by the policy function" corresponds to the mask 
function as specified in table II (page 6). In addition to this user defined function, there is 
another user defined function in the DBMS (Fig. 12, element 1212, page 6, paragraph 
0074) 
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- "Rewriting said database command by creating a modified database command to 
incorporate said condition expression, based on the database command" see page 6, 
paragraph 0074 wherein the original query is translated (Fig. 12, query 1202 is a 
rewriting query) to a translated query (modified database command) that incorporate said 
condition expression (mask functions). 

♦ As per claims 4, 13, Fujiwara discloses: 

- "Wherein the policy is not triggered by detecting that a database command requires 
access to a subset of tables of the at least two tables, wherein the subset of tables includes 
at least one table" corresponds to the query that specified one or more columns in a 
certain table (See paragraph 0068 of Fujiwara). 

♦ As per claims 7, 16, Fujiwara discloses: 

- "Wherein the detecting includes detecting that metadata defines the particular 
combination of columns as a combination of columns to which access is controlled" as 
indicated above, Fujiwara teaches that the user issues a query that is a combination of 
columns (paragraph 0068 of Fujiwara) and the access is controlled by including the mask 
function to mask out some data that the user does not have access permit (paragraph 0075 
of Fujiwara). 

♦ As per claims 8, 17, Fujiwara discloses: 

- "Further comprising the step of registering a policy function with a policy, wherein the 
policy function returns a condition expression, and the modified database command is 
based on the condition expression and the database command" since the mask functions 
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in the package mask are stored in the web/report server (Fig. 6-7 of Fujiwara), the 
policy must be registered in order to carry out the invention. 

♦ As per claims 9, 1 8, Fujiwara discloses: 

- "Wherein the policy includes metadata identifying columns that are included in the 
particular combination of information" See Fig. 10-13 of Fujiwara wherein the policy 
includes metadata identifying columns (such as PT_ID) that are included in the particular 
combination of information (different tables). 

Response to Arguments 
6. Applicant's arguments filed 1/22/2007 have been fully considered but they are not 
persuasive. 

♦ Applicant argues that "Triggering re-writing a database command responsive to detecting that 
at least two columns from different tables are being accessed, as claimed, differs from Fujiwara, 
in which only a single column is involved". The Examiner respectfully disagrees. 

As discussed above, Fujiwara discloses a SELECT statement that can select multiple 
tables (Fig. 11). Therefore, clearly this command requires access two or more columns in at least 
two tables as claimed in claims invention. The query is triggered to rewrite the query based on 
the access policy. Therefore, Fujiwara discloses ""Triggering re-writing a database command 
responsive to detecting that at least two columns from different tables are being accessed, as 
claimed". 

♦ Applicant argues that "Modifying a query with a database server, as claimed, also differs from 
Fujiwara, in which queries are re-written before (e.g., in another part of a system from) a 
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database server, database management system (DBMS), etc.". The Examiner respectfully 
disagrees. 

Fujiwara teaches "a single computer system can be used to host all three servers 
components in a small scale operation" (page 3, paragraph 0041). Therefore, the Examiner 
would interpret the database servers in the reference as single computers sever. Therefore, the 
queries are re-written in the database server, not another part of a system. 
♦ Applicant argues that "User defined policy functions that return expressions, which are 
incorporated into a query, as claimed, further differs from Fujiwara, in which a user defined 
function returns a value for a column, which is in the results, and the output functions of 
Fujiwara are not incorporated in a query". The Examiner respectfully disagrees. 

Applicant did not clearly defined how the user defined policy functions that return 
expressions are differed with the user defined function returns a value for a column. As seen in 
Fig. 12, the query is rewritten to corporate the mask functions into the query which is derived 
from the policy function. Therefore, the mask function is the user defined policy functions that 
return expressions as claimed in the invention. 

Conclusion 

7. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
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will expire on the date the advisory action is mailed,, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CamLinh Nguyen whose telephone number is (571) 272 - 4024. 
The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Apu Mofiz can be reached on (571) 272 - 4080. The fax phone number for 
the organization where this application or proceeding is assigned is 571 - 273 - 8300. 
Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Nguyen, Cam-Linh 
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